FirstBank Canceling Debit Cards Due To ‘Possible External Security’ Incident; Accounts May Have Been Compromised, The Bank Warns (Update)

Update |After a news report on The Consortium this morning revealed what FirstBank has described as an external security breach that prompted the bank to cancel debit cards of affected account holders, the bank’s marketing and communications manager in the Virgin Islands, Alana Alexander, shared more details about the breach, including the number of customers affected, and the nature of the breach.

Ms. Alexander said the breach was not of the bank’s omline systems, but that of a number of merchants throughout the territory and beyond — whose identities she decided not to reveal — where FirstBank account holders made transactions. She said so far about 50 FirstBank account holders have been identified as affected, although the number could rise. Emails were sent to all those affected, Ms. Alexander assured.

“As a result and to mitigate the risk, we canceled the cards and are distributing new cards,” Ms. Alexander said. She said such occurrences have happened in the past, and the bank has taken similar action to mitigate any potential risk of fraud, identity theft and other illicit activities associated with breach of information.

Ms. Alexander said while the number of affected account holders could rise, the bank did not think it was prudent to cancel the debit cards of all account holders, as FirstBank expressed confidence that the matter was under control. She said bank personnel are specifically assigned to monitor the matter, and that an investigation has been launched.

Relative to naming the merchants whose systems were breached, Ms. Alexander said, “I do know those merchants, but I’m not able to let you know who those merchants are,” citing the ongoing investigation.

The affected debit cards are being canceled on Monday, Ms. Alexander said, because the bank is sensitive to the needs of its clients during the Mother’s Day weekend. On Monday, the current debit cards of affected account holders will be canceled and new ones issued. Customers with immediate needs are encouraged to visit their local branch for a temporary replacement.

Original Story | FirstBank, whose presence in the U.S. Virgin Islands is second only to Banco Popular’s, is canceling debit cards as soon as Monday because of what the bank described as a “possible external security” incident that affected the bank. The debit cards are being canceled, FirstBank said in emails sent to account holders, because accounts may have been compromised. Firstbank is also advising its customers to stay alert for the next 12 to 24 months and notify the bank of any suspicious activity.

Among the accounts receiving the emails was a VI Consortium FirstBank account. The email reads: “Due to a possible external security incident to FirstBank, your debit card number ending in [redacted] may have been compromised. Given this situation, and to reduce the risk of improper access to your account, we will be canceling your card effective on Monday, May 13, 2019.”

The bank added, “Your deposit account has not been canceled or altered in any way; you will keep your account number and continue to enjoy the same benefits. If you have an additional debit card that has not been committed, you can continue using it. If you need a provisional card while receiving your new card you can visit any of our branches. If you have recurring payments scheduled to your debit card you must exchange them for an alternate payment method in what you receive and set the payments to your new card.”

The notification also said, “As a precautionary measure, we recommend that you stay alert for the next 12 to 24 months and notify us immediately of any incident or suspicion related to identity theft. Check your account statements and inform us immediately of any situation. If you suspect that you have been the victim of identity theft, please call the credit reporting agencies immediately and request that an identity theft alert be placed on your credit report. In addition, you can request your free credit report at any of the credit reporting agencies.”

FirstBank did not go into detail on the possible security breach, and though a Firstbank Puerto Rico representative was able to confirm the email and incident via phone this morning, the representative was not cleared to speak on the matter, and officials were not available for comment at time of writing. The representative said customers will be issued new debit cards autonomically, and advised those with pending transactions to visit a local branch for a temporary replacement.

External threats are usually malicious campaigns that attempt to exploit security exposures in a company’s attack surface that exists outside the firewall. Targeted external threats can compromise employee or customer data security.

Below are the credit reporting agencies’ websites and contact numbers:

Equifax: Website, #: 1-800-525-6285

Experian: Website, #: 1-888-397-3742

TransUnion: Website, #: 1-800-680-7289

To call FirstBank for more information, reach the bank’s Solution Center at 787-725-2511, or call toll free 1-866-695-2511.

The bank said it would continue to take preventive measures to protect customers’ financial relationships.

Feature Image: FirstBank in Sunny Isle, St. Croix